security.action

import db from 'svr-api/db';
import security from "svr-api/security";
/**
 * 当一个用户登录成功后，执行一次此钩子函数。可以通过此钩子函数修改当前用户的登录信息（包括权限列表等）。
 *
 * 如果抛出异常，那么将导致用户登录失败，可用于进行额外的登录验证判断。
 * 
 * 属于用户组`admin`的用户在登录时候，不受此函数影响
 */
function onDidSignin(request: HttpServletRequest, response: HttpServletResponse, user: CurrentUser): void {
    if (user.userInfo.userId == 'erpapp') {
        // print(user)
        // print(user.userInfo)
        // print(request.getRequestURI() +'222')
        return
    }
    var { wechatUnionid, createTime, userName, wechatMiniprogramOpenid, wechatOpenid, phone } = user.userInfo;
    if (wechatUnionid) {
        var defaultDs = db.getDefaultDataSource(); // 本系统默认数据连接，存储了内置的用户表
        // 微信授权登录的用户，根据szsys_4_external_users中的WECHAT_UNIONID关联fact_customautofans中的unionId，关联上了则更新fact_customautofans，否则插入一条数据
        var factFansTableData = defaultDs.openTableData("fact_customautofans");
        var sqlResult = factFansTableData.executeQuery("select * from fact_customautofans WHERE unionId = ?", [wechatUnionid]);
        // print("查询fact_customautofans" + sqlResult);
        if (!sqlResult.length) {
            // print("创建粉丝");
            // 创建粉丝信息
            factFansTableData.insert({ CREATEDBY: 'admin', CREATEDAT: createTime, FASID: wechatUnionid, APPOPENID: wechatMiniprogramOpenid, PHONE: phone, UNIONID: wechatUnionid });
        } else {
            // print("更新粉丝");
            // 更新粉丝信息
            factFansTableData.update({ CREATEDBY: 'admin', CREATEDAT: createTime, FASID: wechatUnionid, APPOPENID: wechatMiniprogramOpenid, PHONE: phone }, { UNIONID: wechatUnionid });
        }
        if (phone) {
            var factTableData = defaultDs.openTableData("fact_account");
            var factSqlResult = factTableData.executeQuery("select * from fact_account where phone = ?", [phone]);
            // print("查询fact_account" + factSqlResult);
            if (factSqlResult?.length) {
                // print("开始更新客户信息");
                // 更新客户信息 根据fact_customautofans中的phone关联fact_account中的phone，更新fact_account
                factTableData.update({ WXUNIONID: wechatUnionid, FANSID: wechatUnionid, APPOPENID: wechatMiniprogramOpenid, SERVICENUMBEROPENID__C: sqlResult[0].officialOpenid }, { PHONE: phone });
            }

            // 微信授权登录的用户，根据szsys_4_external_users中的phone来更新szsys_4_users表的WECHAT_UNIONID
            var userTableData = defaultDs.openTableData("szsys_4_users");
            var userSqlResult = userTableData.executeQuery("select * from szsys_4_users WHERE phone = ?", [phone]);
            if (userSqlResult.length) {
                // 更新szsys_4_users的WECHAT_UNIONID
                userTableData.update({ WECHAT_UNIONID: wechatUnionid }, { PHONE: phone });
            }
        }
    }
}

import utils from "svr-api/utils";
import http from 'svr-api/http';

let ddAppkey = 'dingo0b7xk3j4y9bsbwf';// 请按需替换为创建应用的ddAppkey
let ddAppsecret = 'mXEydyH0HmkOtFlg39s55hVdBqMJDN5e6vejBSuEoJ2TAaidlkI9Ikny5geXvDWU';//请替换为创建应用的秘钥
let dingdingSSOId = "dingding";// 替换为创建的单点登录方案ID

let OAAppkey = '8cbb1536-789a-499a-8fa2-433a3bb2449c';// 请按需替换为OA的应用标识appid
let OAppsecret = 'hg5VNKjDLwKzWHPC22rDsbrq';//请替换为OA的秘钥appsecret
let OASSOId = "OAuser";// 替换为创建的单点登录方案ID
let OADomain = 'https://oa.hangyang.com'; // 替换为OA的ip或域名地址
let OARedirect_uri = 'https://dioc.hangyang.com/datacvgbi/api/auth/redirect?ssoid=OAuser&redirect_url=%2FMENHU%2Fapp%2FGAS_PLATE.app'; // 替换为OA里配置的应用地址
/**
 * 用于构建跳转钉钉授权展示界面的URL，为通过钉钉工作台中打开应用时调用
 */
function onSSOGetAuthRedirectURL(request: HttpServletRequest, response: HttpServletResponse, redirect_uri: string, ssoArgs: SSOArgs): boolean | string {
    let session = request.getSession();
    let state = utils.uuid().substring(0, 5)
    session.setAttribute("state", state);

    let ssoid = request.getParameter('ssoid');
    let url;
    if (ssoid === dingdingSSOId) {
        url = getDingtalkLoginUrl(state, redirect_uri);
    }
    if (ssoid === OASSOId) {
        url = getOALoginUrl(state, redirect_uri);
    }
    if (url == null) {
        return false;
    }

    print('url ' + url);
    return url;
}

function getDingtalkLoginUrl(state: string, redirect_url: string) {
    print('ddAppkey ' + ddAppkey);
    return `https://login.dingtalk.com/oauth2/auth?redirect_uri=${encodeURIComponent(redirect_url)}&response_type=code&scope=openid&prompt=consent&client_id=${ddAppkey}&state=${state}`;
}

function getOALoginUrl(state: string, redirect_url: string) {
    redirect_url = redirect_url.replace('?&', '?')
    print('OAAppkey ' + OAAppkey);
    return `${OADomain}/sso/oauth2.0/authorize?client_id=${OAAppkey}&redirect_uri=${encodeURIComponent(redirect_url)}&response_type=code&state=${state}`
}

/**
 * 用于用户在钉钉授权页面点击授权后，跳转到BI时调用（这个地址由 getDingtalkLoginUrl 函数返回URL中的redirect_uri参数决定）
 */
function onSSOCheckTicket(request: HttpServletRequest, response: HttpServletResponse, ssoArgs: SSOArgs): UserInfo | void {
    let ssoid = request.getParameter('ssoid');
    print('ssoid ' + ssoid);
    if (ssoid === dingdingSSOId) {
        return doDingTalkAuth(request, response, ssoArgs);
    }
    if (ssoid === OASSOId) {
        return doOAAuth(request, response, ssoArgs);
    }
}

function doDingTalkAuth(request: HttpServletRequest, response: HttpServletResponse, ssoArgs: SSOArgs): UserInfo | void {
    let code = request.getParameter('authCode');
    print("ding code is " + code);
    if (!code) {
        response.sendRedirect(request.getContextPath() + '/login');
        return;
    }

    let json = JSON.parse(http.request({
        url: "https://api.dingtalk.com/v1.0/oauth2/userAccessToken",
        method: "POST",
        data: {
            clientId: ddAppkey,
            clientSecret: ddAppsecret,
            code,
            grantType: "authorization_code"
        },
        headers: {
            "Content-Type": "application/json"
        }
    }).responseText);
    print('ding userAccessToken ' + JSON.stringify(json));

    let access_token = json.accessToken;

    json = JSON.parse(http.request({
        url: "https://api.dingtalk.com/v1.0/contact/users/me",
        method: "GET",
        headers: {
            "Content-Type": "application/json",
            "x-acs-dingtalk-access-token": access_token
        }
    }).responseText)
    print('ding userInfo ' + JSON.stringify(json));

    /* 返回一组用户信息，用于匹配在系统中存储的用户 */
    return <{
        /** id， 同 userId */
        userId: string;
        /** 用户名称， 同 userName */
        USER_NAME?: string;
        /** 部门ID */
        DEPT_ID?: string;
        /** 电话 */
        PHONE?: string;
        /** 邮箱 */
        EMAIL?: string;
        /** 获取头像地址 */
        avatar?: string;
        /** 扩展字段数据, 为用户表字段的名称*/
        [propName: string]: any;
    }>{
            userId: json.unionId,
            USER_NAME: json.nick,
            PHONE: json.mobile,
            EMAIL: json.email,
            avatar: json.avatarUrl === '' ? undefined : json.avatarUrl
        };
}
function doOAAuth(request: HttpServletRequest, response: HttpServletResponse, ssoArgs: SSOArgs): UserInfo | void {
    let code = request.getParameter('ticket');
    print("code is " + code);
    if (!code) {
        response.sendRedirect(request.getContextPath() + '/login');
        return;
    }

    let json = JSON.parse(http.request({
        url: `${OADomain}/sso/oauth2.0/accessToken`,
        method: "POST",
        data: {
            client_id: OAAppkey,
            client_secret: OAppsecret,
            code,
            grant_type: "authorization_code",
            redirect_uri: OARedirect_uri
        },
        // headers: {
        //     "Content-Type": "application/json"
        // }
    }).responseText);
    print("accessToken " + JSON.stringify(json));

    let access_token = json.access_token;

    json = JSON.parse(http.request({
        url: `${OADomain}/sso/oauth2.0/profile?access_token=${access_token}`,
        method: "GET",
        headers: {
            // "Content-Type": "application/json",
            // "x-acs-dingtalk-access-token": access_token
        }
    }).responseText)
    print("profile " + JSON.stringify(json));
    /* 返回一组用户信息，用于匹配在系统中存储的用户 */
    return <{
        /** id， 同 userId */
        userId: string;
        /** 用户名称， 同 userName */
        USER_NAME?: string;
        /** 部门ID */
        DEPT_ID?: string;
        /** 电话 */
        PHONE?: string;
        /** 邮箱 */
        EMAIL?: string;
        /** 获取头像地址 */
        avatar?: string;
        /** 扩展字段数据, 为用户表字段的名称*/
        [propName: string]: any;
    }>{
            userId: json.id,//只传第一个userId都可以,
            USER_NAME: json.attributes.lastname,
            PHONE: json.attributes.mobile,
            EMAIL: json.attributes.email,
            // avatar: json.avatarUrl === '' ? undefined : json.avatarUrl
        };
}

/**
 * 通过浏览器访问，当url中没有通过method指定执行的函数时，默认执行此函数。
 * 
 * @param request `HttpServletRequest`
 * @param response `HttpServletResponse`
 * @param params 请求参数，通常是一个json对象：
 *  1. params.param1 等价于 `request.getParameter('param1')`
 *  2. 当请求的`Contect-Type`==`application/json`（前端通过`rc`函数进行的调用）时，那么返回请求体的json对象, 等价于`request.getRequestBody()`
 */
import db from 'svr-api/db';// 操作数据库： https://docs.succbi.com/v4/dev/server-script-api/db/#import
import security from 'svr-api/security';//登录相关api： https://docs.succbi.com/v4/dev/server-script-api/security/#import
import http from 'svr-api/http'; // 发送http请求：https://docs.succbi.com/v4/dev/server-script-api/http/#import
export function execute(request: HttpServletRequest, response: HttpServletResponse, params: any) {
    const AppID = "wxcd076dd0c6cd6a7c";
    const AppSecret = "45049736a2eb6052cfd83a6d078910a6";
    let code = request.getParameter("code");
    let redirectUrl = request.getParameter("redirect_url");
    if (!code) {
        return "code 不存在";
    }

    let str = http.get(`https://api.weixin.qq.com/sns/oauth2/access_token?appid=${AppID}&secret=${AppSecret}&code=${code}&grant_type=authorization_code`);// 拼接 访问微信服务获取 openid 
    let json = JSON.parse(str);
    let openid = json.openid;

    if (openid) {
        let userId: string = db.getDefaultDataSource().selectFirst("select user_id,user_name from szsys_4_users where WECHAT_OPENID = ?", [openid])?.user_id;
        if (userId) {
            security.loginWithoutPassword(userId);
            // 登录后的页面，目前用的个人主页
            response.sendRedirect(redirectUrl ?? "https://dqyzm.datacvg.com/dqyzm/DQYZM/app/%E7%A7%BB%E5%8A%A8%E7%AB%AF.app/%E4%B8%AA%E4%BA%BA%E4%BF%A1%E6%81%AF/%E4%B8%AA%E4%BA%BA%E4%B8%BB%E9%A1%B5.spg");
        } else {
            // 用户不存在，需要重定向到用户信息填写界面 - 这个页面得不用再登录就可以访问
            response.sendRedirect("https://dqyzm.datacvg.com/dqyzm/DQYZM/app/%E7%A7%BB%E5%8A%A8%E7%AB%AF.app/%E4%B8%8A%E6%8A%A5%E9%A1%B5%E9%9D%A2/%E4%B8%8A%E6%8A%A5%E9%A1%B5%E9%9D%A2.spg&openid=" + openid);
        }
    }

}